Jump to a page or a control
Protect · Established tier · Infrastructure Security
Every change to a security platform has an approved change record and an as-built record, so the running configuration reconciles with the approved baseline.
Status
Gap1 item contradicts the control.
Exposure
High
2 evidence items from 2 sources
CCSA · Protect
Below FoundationalNot blocking this domain's next tier.
9 of 41 security platform changes in the last 30 days have no matching change record.
Remediation · Infrastructure Security
Block Panorama commits that carry no change number, and backfill records for the 9 changes.
Root cause: Payments migration. A temporary firewall rule and unrecorded changes were left behind.
Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.
ev-pr07-1
9 of 41 changes in 30 days have no change record
Palo Alto Networks Panorama · telemetry · collected 2 h ago (Oct 15, 2026 · 11:59 UTC) · limit 168 h
Powered by Mesh APIshow config audit commits last 30def620f97c5e160f257b5a63c5d0b2077d89804921ed4278c9532a2b3921a28ab
ev-pr07-2
13 of 32 change records closed without an as-built attachment
ServiceNow ITSM · ticket · collected 27 h ago (Oct 14, 2026 · 10:59 UTC) · limit 168 h
GET /api/now/table/change_request?sysparm_query=category=security^closed_at>javascript:gs.daysAgo(30)ccfc41283d19f913dceee681b11530a94721c9ac316a237b6c430063418cd69a